CVE-2026-64353

In the Linux kernel, the following vulnerability has been resolved:

bpf: Keep dynamic inner array lookups nullable

An ARRAYOFMAPS can use an array created with BPFFINNERMAP as its inner map template. A concrete inner array with a different maxentries value can then replace the template.

After a successful outer map lookup, the verifier represents the resulting map pointer using the inner map template. Const-key lookup nullness elision consequently uses the template maxentries even though the runtime helper uses the concrete inner map maxentries.

Do not elide lookup result nullness for maps marked with BPFFINNERMAP, because the template maxentries does not prove that the key is in bounds for the concrete runtime map.